| Package | Affected versions | Patched versions |
|---|---|---|
| react sdk | < 3.53.0 | 3.53.0 |
| matrix-react-sdk | < 3.53.0 | 3.53.0 |
Events sent with special strings in key places can temporarily disrupt or impede the matrix-react-sdk from functioning properly, such as by causing room or event tile crashes. The remainder of the application can appear functional, though certain rooms/events will not be rendered.
This is fixed in matrix-react-sdk 3.53.0
There are no workarounds. Please upgrade immediately.
https://learn.snyk.io/lessons/prototype-pollution/javascript/
If you have any questions or comments about this advisory please email us at security at matrix.org.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free